From 31a2ac94c75a32877a2f63ba8c30e6a43116fd73 Mon Sep 17 00:00:00 2001 From: Andrew Smith Date: Tue, 8 Mar 2022 01:41:09 -0600 Subject: [PATCH] LibGUI: Fix crash in GML Playground auto-completing SpinBox props Crash was caused by deferred invocation of a lambda on the SpinBox's TextEditor widget's on_change. The lambda referenced the SpinBox ptr, but in GML Playground the SpinBox was free'd before the deferred lambda could run, causing a use-after-free error. Fixed by using a weak ptr to detect if the SpinBox was free'd. --- Userland/Libraries/LibGUI/SpinBox.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Userland/Libraries/LibGUI/SpinBox.cpp b/Userland/Libraries/LibGUI/SpinBox.cpp index ad988d4681..e46278376b 100644 --- a/Userland/Libraries/LibGUI/SpinBox.cpp +++ b/Userland/Libraries/LibGUI/SpinBox.cpp @@ -18,7 +18,10 @@ SpinBox::SpinBox() set_fixed_height(22); m_editor = add(); m_editor->set_text("0"); - m_editor->on_change = [this] { + m_editor->on_change = [this, weak_this = make_weak_ptr()] { + if (!weak_this) + return; + auto value = m_editor->text().to_uint(); if (value.has_value()) set_value(value.value());